Home / Docs

Fally documentation

Fally is an API key manager for teams. Store your third-party vendor API keys — Stripe, OpenAI, AWS, and the rest — with a required owner and purpose, organized by team and environment, so you always know who owns what and can hand keys off cleanly when people leave.

The model

Everything in Fally sits in a simple hierarchy:

• Organization — your company. It holds one bill, one member directory, and single sign-on. Each member has a role: owner, admin, or member.
• Project — a siloed set of keys, typically one per product or repo. Members only see the projects they've been added to.
• Team — a group inside a project (for example Growth or Infra). Every secret belongs to a team.
• Secret — a stored API key with a name, vendor, an environment (production, staging, development, or other), a required owner, and a required purpose. The value is encrypted and stays hidden until you deliberately reveal it.

Who can see what

Org owners and admins see every project and team. Plain members see only the projects they've been added to, and within those, only their teams. Access to a key comes in three levels:

• Read (reveal, copy) — an admin, the key's owner, a member of its team, or someone holding a time-boxed access grant.
• Change (rotate, archive, edit its details) — the same, minus grants. A grant lets you read a key, never change it.
• Manage (reassign the owner, move it between teams, delete it) — the key's owner or an admin.

Production is stricter: team membership alone doesn't open a production key — you need to be an admin, the key's owner, or hold an explicit grant.

How values are stored

Every value is encrypted with envelope encryption (AES-256-GCM) before it's written, so the database never holds a plaintext secret, and each value is bound to its own project and key. Fally isn't a vault for injecting secrets into your running apps — it's the record of what exists, who owns it, and why.

Next

• Quickstart — create your first key in the web app.
• CLI & MCP — use Fally from your terminal and from AI agents.